Stripe Service Providers (Sub-Processors)

This document is Stripe's publicly published list of Service Providers, Sub-Processors, and Affiliates, maintained pursuant to data protection obligations under frameworks including GDPR, which requires controllers and processors to disclose sub-processing arrangements. The document enumerates third-party entities and Stripe affiliates to which personal data may be transferred or made accessible in connection with Stripe's payment processing, fraud detection, infrastructure, analytics, customer support, and compliance services. The document identifies sub-processors by name, country of establishment, and processing purpose, consistent with standard GDPR Article 28 disclosure practice; however, the level of specificity regarding data categories transferred to each sub-processor varies, and the document does not enumerate retention periods or individual data subject rights mechanisms. This list engages GDPR and UK GDPR sub-processor disclosure obligations, SCCs and Data Transfer Addenda for cross-border transfers outside the EEA and UK, and equivalent transfer frameworks in other jurisdictions where Stripe operates; organizations subject to GDPR who use Stripe as a data processor are required under Article 28 to maintain awareness of and, in many cases, consent to sub-processor additions. Compliance teams at merchant organizations should evaluate whether their DPA with Stripe incorporates objection rights for new sub-processor additions and whether the listed cross-border transfers satisfy their own data transfer obligations.